In a Help Net Security video, Skycloak founder Guilliano Molaire argues that vendor concentration risk is easy to miss. A company may pay 30 vendors and assume its tooling is spread out, but many of those vendors run on the same few providers underneath — one cloud, one identity provider, one DNS service, one email provider, one payment processor, or one AI model provider. When one of those goes down, more of the business breaks than the contracts suggest.
Molaire walks through a four-step mapping exercise using a fictional 200-person company, starting with a list of direct vendors and narrowing them down to about five choke points. He also covers warning signs to watch for, questions to ask vendors, and contract terms around exit help, data portability, and SLAs. Architecture steps include standard protocols, export drills, and backup identity paths.
The video closes with a four-week plan teams can start on Monday, giving security and IT leaders a concrete way to reduce concentration risk without waiting for an outage to expose it. The source is a single video summary, so no differing views are noted. It is practical guidance rather than a research report, and the specific steps are presented as Molaire's{